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Summary 

As a result of the terrorist attacks of September 11, 2001, Congress passed 
legislation creating the Transportation Security Administration (TSA). The agency 
was charged with making improvements to the country’s transportation security 
systems and protecting against future terrorist attacks. TSA was also given the 
authority to establish regulations for protecting certain information from public 
disclosure. These regulations govern sensitive security information, or SSI. 

The SSI regulations prohibit TSA officials and employees having a “need to 
know” status from disclosing transportation security information that details security 
programs and equipment; training and security procedures; vulnerability assessments; 
or other related information. The regulations pertaining to SSI are exempt from 
Freedom of Information Act disclosure. TSA is required, however, to provide SSI 
to authorized congressional committees. 

The purpose of the SSI regulations is to restrict information relative to future 
terrorist attacks. TSA’s application of the SSI regulations has, however, resulted in 
some controversies over airport security procedures, employee accountability, 
passenger screening, and airport secrecy agreements. Some experts believe that too 
much information has been kept from the public in these circumstances. TSA states, 
however, that protecting SSI is warranted because of the need to protect 
transportation systems. 

A fundamental issue in this controversy is the tension between securing the 
nation’s transportation systems and keeping the public informed. Democratic 
governments benefit from an informed citizenry; however, broad openness may 
provide potential enemies with information that enables attacks on the transportation 
infrastructure. What level of risk resulting from public access to SSI is acceptable 
to policymakers and the public? What alternatives are available to the present 
system, and what are their strengths and weaknesses? 

This report provides background information on and analysis of issues 
concerning the SSI regulations. Additionally, it identifies the transportation security 
and information issues at the heart of this debate. Finally, the report outlines and 
assesses policy options for Congress, including endorsing current regulations, giving 
greater specificity to TSA’s protection requirements, setting time limits for 
protection, creating an advisory commission, requiring periodic congressional 
briefings, or establishing an oversight board. This report will be updated as events 
warrant. 
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Introduction 

Democratic governments face a difficult tension in weighing their duty to 
protect information vital to security concerns while keeping the public informed. The 
9/11 terrorist attacks on the World Trade Center and the Pentagon gave greater 
emphasis to this issue in the context of an immediate need for the federal government 
to protect the nation from future terrorist attacks. 

Given that the 9/11 terrorist attacks were accomplished using commercial 
airliners as weapons, Congress sought to strengthen transportation security by 
establishing the Transportation Security Administration (TSA). 1 Congress directed 
the new agency to assess and protect against threats to the nation’s air, land, and 
maritime transportation systems. In the act creating the new agency, Congress 
incorporated the concept of sensitive security information (SSI) and directed the 
agency to establish regulations to protect such information from public disclosure 
when disclosure would detract from the security of the nation’s transportation system 
and the safety of travelers and crews. Accordingly, TSA is faced with finding an 
appropriate balance between its mandate to protect SSI from disclosure and the need 
to keep the public adequately informed about transportation security. 

The application of SSI regulations issued by the TSA, however, has generated 
controversy. Some critics charge that the agency has withheld too much information 
from the public. Pilots, fight attendants, and consumer advocates assert that TSA “is 
muzzling debate of security initiatives by labeling too many of the agency’s policies 
and reports as too sensitive for public dissemination.” 2 For some, the issue is simply 
a conflict between two arguably legitimate needs — the need for security versus the 
public’s need for open access to information so they can make rational travel and 
transportation decisions for themselves. Jane E. Kirtley, director of the Silha Center 
for the Study of Media Ethics and Law at the School of Journalism and Mass 
Communication at the University of Minnesota encapsulated the problem when she 



1 S. 1447, 107 th Cong., approved as P.L. 107-71 on November 19, 2001. See also “Remarks 
on Signing the Aviation and Transportation Security Act,” Weekly Compilation of 
Presidential Documents, vol. 37, Nov. 19, 2001, pp. 1687-88. 

2 Sara Kehaulani Goo, “TSA Faulted for Restricting Information,” Washington Post, Oct. 
10, 2003, p. All. 
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said that the issue comes down to whether “our openness was what made us so 
vulnerable.” 3 

With a view to informing congressional debate on whether the TSA has 
achieved an appropriate balance between security needs and the information needs 
of the traveling public, this report traces the origin of the SSI concept and its 
incorporation into TSA transportation security regulations; it explains how the 
treatment of sensitive security information differs from the treatment of national 
security information; it discusses the tensions inherent between the need to protect 
sensitive information and the need to advise the traveling public adequately on 
transportation security matters; and it presents and analyzes pertinent legislative 
policy options that may be of interest to Congress. 



SSI and the Development of SSI Regulations 

Sensitive security information is information that describes air carrier screening 
procedures, airport or air carrier security programs, maritime transportation security 
procedures, or other related transportation security matters. The SSI concept appears 
in federal statutes that prohibit the disclosure of information obtained or developed 
in carrying out security activities if the TSA Administrator (formerly the Under 
Secretary of Transportation for Security) determines that such disclosure would “be 
detrimental to the safety of passengers in transportation.” 4 TSA regulations specify 
the categories of information that may be protected as SSI. 5 When the TSA 
designates information as SSI, its disclosure is limited by a strict need-to-know basis 
as determined by TSA; disclosure restrictions remain in force until revoked by TSA. 

Statutory Authority 

On November 16, 2001, 63 days after the attacks of September 11, Congress 
passed the Aviation and Transportation Security Act (ATSA), which the President 
signed into law on November 19. 6 Under ATSA, Congress created the 
Transportation Security Administration (TSA) — then an agency of the Department 
of Transportation, but now located within the Department of Homeland Security — 
and authorized the agency to make improvements in the country’s transportation 
security. 7 



3 Quoted in Bryon Okada, “Public Will Not Be Told Details of D/FW Breach,” Fort Worth 
Stcir-Telegrcim , Jan. 24, 2003, p. 1. 

4 49 U.S.C.§ 1 14(s)(l) and 49 U.S.C. § 401 19(b)(1). 

5 49 C.F.R. § 1520.7. 

6 S. 1447, 107 th Cong., P.L. 107-71. See also “Remarks on Signing the Aviation and 
Transportation Security Act,” Weekly Compilation of Presidential Documents, vo 1 . 37, Nov. 
19, 2001, pp. 1687-88. 

7 The act assigns TSA responsibility for inspecting persons and property carried by U.S. 
aircraft operators and foreign air carriers operating in the U.S. These responsibilities cover 
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